Granted Patent B2

US 12,341,872 · App. 16/620,241 · Granted Jun 24, 2025

Inventor: Joshua Daniel (London, GB)

Assignee: British Telecommunications Public Limited Company

H04L9/0819H04L9/0643H04L9/3247H04L9/50

Abstract

Claims (32)

1. A computer implemented method of non-repudiatively transitioning management of a cryptographic key from a first hardware security module (HSM) to a second HSM, the cryptographic key being associated with the first HSM by a digitally signed record in a blockchain, the blockchain being accessible via a network and including a plurality of records validated by miner computing components, wherein the blockchain is not relied on for management or storage of the cryptographic key, the method comprising:

receiving a request from the second HSM to associate the cryptographic key with the second HSM, the request having associated identification information for a requester of the cryptographic key;

verifying an entitlement of the requester to the cryptographic key by the first HSM, wherein the entitlement of the requester is verified based on the identification information for the requester;

responsive to the verification by the first HSM, generating a new record for storage in the blockchain, the new record associating the cryptographic key with the second HSM and being validated by the miner components;

further responsive to the verification by the first HSM, securely and non-repudiatively transferring the cryptographic key from the first HSM to the second HSM;

verifying that the cryptographic key is associated with the second HSM in the blockchain; and

responsive to the verification that the cryptographic key is associated with the second HSM, transferring the cryptographic key from the second HSM to the requester of the cryptographic key.

2. The method of claim 1 , wherein the new record for storage in the blockchain includes a reference to an original record for the cryptographic key such that the new record supersedes the original record to associate the cryptographic key with the second HSM and to disassociate the cryptographic key from first HSM.

3. The method of claim 1 , wherein at least some of the miner computing components are hardware security modules (HSMs).

4. The method of claim 1 , wherein the blockchain is a distributed transactional database.

5. The method of claim 1 , wherein the miner components confirm a state of the blockchain by reaching a consensus as to the state of the blockchain based on a proof of work.

6. The method of claim 1 , further comprising:

further responsive to the verification of the entitlement of the requester, effecting a change to the second HSM for providing the cryptographic key, the change being relative to the resource cost of ownership of the cryptographic key.

7. A computer system comprising:

a processor and memory storing computer program code for non-repudiatively transitioning management of a cryptographic key from a first hardware security module (HSM) to a second HSM, the cryptographic key being associated with the first HSM by a digitally signed record in a blockchain, the blockchain being accessible via a network and including a plurality of records validated by miner computing components, wherein the blockchain is not relied on for management or storage of the cryptographic key, by:

receiving a request from the second HSM to associate the cryptographic key with the second HSM, the request having associated identification information for a requester of the cryptographic key;

verifying an entitlement of the requester to the cryptographic key by the first HSM, wherein the entitlement of the requester is verified based on the identification information for the requester;

responsive to the verification by the first HSM, generating a new record for storage in the blockchain, the new record associating the cryptographic key with the second HSM and being validated by the miner components;

further responsive to the verification by the first HSM, securely and non-repudiatively transferring the cryptographic key from the first HSM to the second HSM;

verifying that the cryptographic key is associated with the second HSM in the blockchain; and

responsive to the verification that the cryptographic key is associated with the second HSM, transferring the cryptographic key from the second HSM to the requester of the cryptographic key.

8. The computer system of claim 7 , wherein the processor and memory storing computer program code for the first HSM to provide access to the cryptographic key includes:

further responsive to the verification of the entitlement of the requester, effecting a change to the second HSM for providing the cryptographic key, the change being relative to the resource cost of ownership of the cryptographic key.

9. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to non-repudiatively transition management of a cryptographic key from a first hardware security module (HSM) to a second HSM, the cryptographic key being associated with the first HSM by a digitally signed record in a blockchain, the blockchain being accessible via a network and including a plurality of records validated by miner computing components, wherein the blockchain is not relied on for management or storage of the cryptographic key, by:

receiving a request from the second HSM to associate the cryptographic key with the second HSM, the request having associated identification information for a requester of the cryptographic key;

verifying an entitlement of the requester to the cryptographic key by the first HSM, wherein the entitlement of the requester is verified based on the identification information for the requester;

responsive to the verification by the first HSM, generating a new record for storage in the blockchain, the new record associating the cryptographic key with the second HSM and being validated by the miner components;

further responsive to the verification by the first HSM, securely and non-repudiatively transferring the cryptographic key from the first HSM to the second HSM;

verifying that the cryptographic key is associated with the second HSM in the blockchain; and

responsive to the verification that the cryptographic key is associated with the second HSM, transferring the cryptographic key from the second HSM to the requester of the cryptographic key.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the computer program code, when loaded into the computer system and executed thereon, cause the computer system to provide access to the cryptographic key further including by:

further responsive to the verification of the entitlement of the requester, effecting a change to the second HSM for providing the cryptographic key, the change being relative to the resource cost of ownership of the cryptographic key.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (120)